UCF STIG Viewer Logo

The Ubuntu operating system must be configured so that three consecutive invalid logon attempts by a user automatically locks the account until released by an administrator.


Overview

Finding ID Version Rule ID IA Controls Severity
V-219166 UBTU-18-010033 SV-219166r610963_rule Medium
Description
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account. Satisfies: SRG-OS-000329-GPOS-00128
STIG Date
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide 2020-12-09

Details

Check Text ( C-20891r569453_chk )
Check that Ubuntu operating system locks an account after three unsuccessful login attempts with following command:

# grep pam_tally2 /etc/pam.d/common-auth

auth required pam_tally2.so onerr=fail deny=3

If no line is returned or the line is commented out, this is a finding.
If the line is missing "onerr=fail", this is a finding.
If the line has "deny" set to a value more than 3, this is a finding.
Fix Text (F-20890r569454_fix)
Configure the Ubuntu operating system to lock an account after three unsuccessful login attempts.

Edit the /etc/pam.d/common-auth file. The pam_tally2.so entry must be placed at the top of the "auth" stack. So add the following line before the first "auth" entry in the file.

auth required pam_tally2.so onerr=fail deny=3